Is CVE-2026-0321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0321 being exploited in the wild.

How severe is CVE-2026-0321?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Palo Alto Networks PAN-OS 12.2 before 12.2.4; 12.1 before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Palo Alto Networks Prisma Access 12.1 before 12.1.7-h8; 11.2 before 11.2.7-h21; 10.2 before 10.2.10-h41; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.

How is CVE-2026-0321 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-0321?

Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0321: Palo Alto Networks PAN-OS denial of service in network services

CVE-2026-0321 · Severity: info · Published 2026-10-14

Palo Alto Networks PAN-OS is the operating system for enterprise firewalls that protect corporate networks and data. An attacker with network access can send crafted network traffic to a firewall to cause temporary service disruption or force the firewall into maintenance mode, blocking traffic and requiring manual intervention to restore operations.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access, Siemens Ruggedcom Ape1808. Vendors: Palo Alto Networks, Siemens.

Quick answers

Is CVE-2026-0321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0321 being exploited in the wild.
How severe is CVE-2026-0321?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Palo Alto Networks PAN-OS 12.2 before 12.2.4; 12.1 before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Palo Alto Networks Prisma Access 12.1 before 12.1.7-h8; 11.2 before 11.2.7-h21; 10.2 before 10.2.10-h41; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.
Is there a fix for CVE-2026-0321?: Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41. Until then: Customers with Threat Prevention subscription can enable limited protection by activating Threat ID 510038 (available in Applications and Threats content version 9158-10284 and later), though this requires SSL Decryption to be active. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0321 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-0321?: Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41

Customers with Threat Prevention subscription can enable limited protection by activating Threat ID 510038 (available in Applications and Threats content version 9158-10284 and later), though this requires SSL Decryption to be active.

Technical details

Multiple denial of service vulnerabilities in PAN-OS allow an unauthenticated attacker with network access to crash or disable network services by sending specially crafted packets to a dataplane interface. Repeated exploitation forces the firewall into maintenance mode. The vulnerability is in network service handling (CWE-754 improper exception handling) and requires only network access with no authentication or user interaction.

Affected products

Palo Alto Networks PAN-OS 12.2 before 12.2.4; 12.1 before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12
Palo Alto Networks Prisma Access 12.1 before 12.1.7-h8; 11.2 before 11.2.7-h21; 10.2 before 10.2.10-h41
Siemens RUGGEDCOM APE1808 all versions with Palo Alto Networks Virtual NGFW

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.